Skip to main content

🛡️ AWS Inspector ECR Scanning is not enabled🟢

Logic​

Similar Policies​

Description​

Open File

Description​

This policy identifies AWS accounts where Amazon ECR scanning is not enabled.

Amazon Inspector integrates with Amazon ECR to automate container image security. It provides continuous vulnerability scanning by analyzing images when they are pushed to ECR and re-scanning them whenever new Common Vulnerabilities and Exposures (CVE) data becomes available.

Rationale​

Enabling Amazon Inspector for ECR provides the following benefits:

  1. Continuous Assessment: Unlike traditional scan on push, which is a one-time event, Amazon Inspector continuously monitors container images stored in ECR for newly disclosed vulnerabilities throughout their retention period.
  2. Automated Risk Prioritization: Amazon Inspector assigns contextualized risk scores, enabling security teams to prioritize remediation efforts based on the severity and exploitability of vulnerabilities.
  3. CI/CD Integration: Automated vulnerability discovery helps prevent insecure container images from being promoted through CI/CD pipelines and deployed into production environments.

... see more

Remediation​

Open File

Remediation​

Enable Amazon Inspector ECR Scanning​

If you are the delegated administrator for an AWS Organization, you can centrally enable Amazon Inspector scan types across multiple accounts and Regions using the AWS CLI and automation scripts. For additional guidance, refer to the inspector2-enablement-with-cli repository on GitHub.

From Console​

To activate Amazon Inspector ECR scanning:

  1. Open the Amazon Inspector console: https://console.aws.amazon.com/inspector/v2/home

  2. Using the AWS Region selector in the upper-right corner, select the Region where your ECR repositories are located.

  3. In the navigation pane, choose Account management.

  4. Select the account(s) for which you want to enable a scan type.

  5. Choose Activate, then select ECR scanning.

  6. Repeat these steps in each AWS Region that hosts ECR repositories to ensure full coverage.

policy.yaml​

Open File

Linked Framework Sections​

SectionSub SectionsInternal RulesPoliciesFlagsCompliance
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [Inspector.2] Amazon Inspector ECR scanning should be enabled1no data
💼 Cloudaware Framework → 💼 Threat Protection48no data
💼 PCI DSS v3.2.1 → 💼 11.2.1 Perform quarterly internal vulnerability scans. Address vulnerabilities and perform rescans to verify all “high risk” vulnerabilities are resolved in accordance with the entity's vulnerability ranking.2no data
💼 PCI DSS v4.0.1 → 💼 11.3.1 Internal vulnerability scans are performed.32no data
💼 PCI DSS v4.0 → 💼 11.3.1 Internal vulnerability scans are performed.32no data